Answer

Card testing is a burst of small authorization attempts made with stolen card numbers. The attacker reads the response codes to tell live cards from dead ones. You prevent it with four control groups: card data verification, request velocity limits, network and bot filtering, and rules tuned to your own decline data.

Card Testing Prevention Tools: A Buying Guide

Test charges run low on purpose. Common amounts are $0.00, $0.50, $1.00, and $1.50. One botnet can push thousands of attempts in an hour across hundreds of IP addresses. You will not catch every attempt. The goal is to raise the cost per attempt until the attack moves to an easier target.

card testing fraud prevention

Signals worth monitoring

• Decline rate by IP address, by card BIN, and by device fingerprint
• Count of authorization attempts per card in a 24 hour window
• Share of orders under $2.00
• Multiple cards used from one IP or one session
• Failed AVS or CVV checks on new accounts
• Spikes in traffic from data center IP ranges and known proxy services
• Many accounts created from one email domain in a short period

Card data checks

Require the card security code on every transaction. Turn on Address Verification Service and reject on full mismatch for card-not-present orders. Run 3-D Secure on high-risk segments. These checks add friction for the attacker because stolen card data often lacks a correct billing address or code.

Card Testing Prevention Best Practices: A Merchant Guide

Velocity limits

Set hard caps. Examples that work in practice: one authorization attempt per card per 10 minutes, five attempts per IP per hour, three attempts per device per day, and one order per customer per hour. Count failed attempts, not just approvals. Attackers generate failures by design.

How to Reduce Card Testing Attacks: A Comprehensive Guide

Network and bot controls

Block or challenge traffic from hosting providers, VPN exits, and open proxies. Add a CAPTCHA or a proof-of-work challenge on the payment step after two failed attempts in a session. Rate limit the checkout endpoint at the edge, before the request reaches your payment gateway.

Rules and scoring

Build custom rules from your own data, not a generic list. Common rules: block when the email domain was created in the last 30 days, block when the shipping address differs from the billing country, and hold orders where the card BIN country does not match the IP country. Send held orders to manual review.

Response plan

1. Alert when the decline rate for a BIN or IP range passes your baseline by 3 times.
2. Throttle the source, then block it.
3. Contact your processor and report the pattern.
4. Refund or void any test charges that settled.
5. Log the affected card tokens and add them to a block list.

Card testing also carries cost beyond fraud losses. Each attempt carries an authorization fee, and card networks can place a merchant in a monitoring program when dispute and decline ratios stay high. Track attempt volume, fee spend, and dispute counts weekly so the pattern shows up before the fees do.